Method and system for detecting anomaly of user behavior in a network

Abstract

A method and system for detecting anomaly of user behavior in a network with a hierarchical topology, including a plurality of users, at least two bridges to each of which at least one user is connected to and wherein the bridges are configured to be operable to connect the corresponding users to the network, and at least one predetermined profiling network entity, the method includes the steps of: a) determining common behaviors of the users connected to the respective bridges; b) transmitting the determined common behaviors to the profiling network entity; c) determining an overall profile based on the transmitted common behaviors; d) transmitting back the determined overall profile to the bridges; and e) detecting anomaly of user behavior of the users connected to the corresponding bridges based on the overall profile.

The invention claimed is: 
     
       1. A method for detecting anomaly of user behavior in a network with a hierarchical topology, the method performed with a memory available to a computing device comprising at least two bridges to each of which at least one user (U) is connected to and wherein the bridges (P 1 , P 2 , . . . Pn) are configured to be operable to connect the corresponding users (U) to the network, and at least one predetermined profiling network entity (C), which method comprises the steps of:
 a) said bridges determining ( 1   b ) common behaviors of the users (U) connected to the respective bridges (P 1 , P 2 , . . . Pn), 
 b) said bridges transmitting ( 2   b ) data of said determined common behaviors to the profiling network entity (C), 
 c) said profiling network entity determining ( 3   b ) an overall profile based on the transmitted common behaviors, 
 d) said profiling network entity transmitting back ( 4   b ) data of said determined overall profile to the bridges (P 1 , P 2 , . . . Pn), and 
 e) the corresponding brides detecting ( 5   b ) anomaly of user behavior of the users (U) connected to the corresponding bridges (P 1 , P 2 , . . . Pn) based on the overall profile, 
 wherein a new bridge, when joining the network, fetches profiles for user behavior from said profiling network entity and starts to update the determined overall profile by sending the common behaviors of users connected to said bridge. 
 
     
     
       2. The method according to  claim 1 , wherein in step a) and/or in step c) machine learning techniques are performed. 
     
     
       3. The method according to  claim 1 , wherein step c) is performed by majority voting schemes and/or clustering algorithms. 
     
     
       4. The method according to  claim 1 , wherein the bridges (P 1 , P 2 , . . . Pn) disseminate their determined common behavior to other bridges so to provide a plurality of profiling network entities (C). 
     
     
       5. The method according to  claim 1 , wherein the common behaviors are reduced to a corresponding compact representation for steps b)-e). 
     
     
       6. The method according to  claim 1 , wherein step c) includes the step c 1 ) of identifying two groups wherein the first group corresponds to profiles with none or sparse anomalies and wherein the second group corresponds to profiles with more or widespread anomalies. 
     
     
       7. The method according to  claim 1 , wherein step e) is performed with meta-information. 
     
     
       8. The method according to  claim 1 , wherein the common behaviors are determined based on values and fields of an accounting-like representation. 
     
     
       9. The method according to  claim 1 , wherein in step a) and in step c) machine learning techniques, including principal component analysis, are performed. 
     
     
       10. The method according to  claim 1 , wherein step c) is performed by majority voting schemes and/or clustering algorithms, including agglomerative hierarchical clustering. 
     
     
       11. The method according to  claim 1 , wherein step e) is performed with meta-information, including aggregated information about the users (U) corresponding to the bridges (P 1 , P 2 , . . . Pn). 
     
     
       12. A system for detecting anomaly of user behavior in a network with a hierarchical topology, said system comprising:
 at least two bridges (P 1 , P 2 , . . . Pn) to each of which at least one user (U) is connected to and wherein the bridges (P 1 , P 2 , . . . Pn) are configured to be operable to connect the corresponding users to the network, and 
 at least one predetermined profiling network entity (C), wherein, 
 the bridges (P 1 , P 2 , . . . Pn) are configured to be operable to determine common behaviors of the users (U) connected to the respective bridges (P 1 , P 2 , . . . Pn) and to transmit data of the determined common behaviors to the profiling network entity (C), 
 the predetermined profiling network entity (C) is configured to be operable to determine an overall profile based on the transmitted common behaviors and to transmit back data of the determined overall profile to the bridges (P 1 , P 2 , . . . Pn), and 
 the bridges (P 1 , P 2 , . . . Pn) are configured to be operable to detect anomaly of user behavior of the users (U) connected to the corresponding bridges (P 1 , P 2 , . . . Pn) based on the overall profile data, and 
 a new bridge, when joining the network, fetches profiles for user behavior from said profiles network entity and starts to update the determined overall profile by sending the common behaviors of users connected to said bridge.